Could there be a WhatsApp Trojan?

My wife uses an Android phone and received an email from a friend, which appeared to be a WhatsApp video.
However, when she clicked on the link, it took her to a weight loss web site (or some similar crap).
She subsequently received notification that somebody had tried to change her Hotmail security details.
We also realised that everyone on her contact list had received the same email, but now from her.

We've changed her Hotmail password and security details, using a different device and we also installed the Android Avast app, and ran a scan - which found nothing negative.

However, I'm concerned that we don't really know for sure what has been compromised and if there's some malware/a virus on her phone.

I haven't found any good advice on the web about what actions to take in this scenario.
Should we wipe her phone and restore it to factory settings?
If so, how do we back up her photos, videos, text messages, etc., without compromising whatever device or cloud storage that we back up to?

Otherwise, how can we check thoroughly, that there is no remaining infection on the handset?

Backing up is the last resort. Then you flash the stock ROM, install Malwarebytes and AdWare and put back the pictures, etc. But try just installing and running them (one at a time, preferably overnight, with the charger plugged in - they take a while to run) and see if that doesn't clean it up.

Next time she gets a "video" like that, she's going to get a warning from one of the apps and she'll know to delete it, not run it.